Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
769 detections
Filters
Last updated
All Time
Detection languages
293
239
59
42
39
Contributors
188
145
112
101
29
Categories
20,440
11,814
5,871
5,145
4,864
769
Platforms
710
56
10
9
6
Products / Services
317
159
152
133
37
MITRE Techniques
603
504
364
327
195
CVEs
5
4
2
2
1
IDS Classtypes
7
1
IDS Protocols
9
1
Detects the modification or termination of critical Windows security services using the Service Control utility (sc.exe). Attackers frequently disable Defender and associated security center services to allow undetected payload execution.
This rule detects the usage of standard Windows system administration utilities (infinstall.exe, devcon.exe, pnputil.exe, sc.exe) when the command line arguments include keywords commonly associated with driver loading or kernel-level operations, which may indicate the installation of a rootkit or malicious driver.
Detects the unauthorized installation and execution of cloudflared (a Cloudflare Tunnel binary). This rule monitors for PowerShell-based downloading of the binary, silent installation via msiexec, service installation commands, and cloudflared execution from unexpected parent processes, which are patterns often associated with adversary lateral movement or establishing persistence.
Detects the installation of RustDesk as a Windows service, identified via System event log ID 7045. Adversaries may abuse this remote access tool to maintain persistent, unauthorized remote access to compromised systems, as observed in ransomware intrusions.
Detects the creation of the 'MixedSvc' Windows service, which is used by DcRAT malware in Operation DragonReturn for persistence. The malware masquerades as 'Windows Mixed Reality Service' and sets the service's binPath to 'C:\Program Files\Windows Media Player\Mixed Reality.exe'.
Detects the creation or starting of a Windows service on a remote host using the Service Control Manager (sc.exe) utility. This is a common method for lateral movement and remote execution of malicious payloads.
Detects the creation or modification of Windows services using sc.exe where the binary path (binpath) points to suspicious or user-writable directories such as User profiles, AppData, Temp, or Public folders, which are often used by adversaries for persistence or privilege escalation.
Detects the use of the sc.exe utility to create a new service on a remote system by specifying a path using a UNC share. This behavior is indicative of lateral movement, where an attacker attempts to execute code on a remote host by installing a service via SMB/Admin Shares.
Detects the creation of a Windows kernel-mode driver service where the driver binary is located in a suspicious, non-standard directory like Temp, Public, or AppData. This is a common persistence technique for malware, including EDR killers that use vulnerable drivers.
Detects the execution of sc.exe with subcommands 'create' or 'start' where the command line includes a UNC path. This pattern is indicative of an adversary attempting to install or execute a service on a remote host to facilitate lateral movement.
Detects the creation or modification of services associated with PsExec, a legitimate tool often abused by adversaries for remote execution. The rule looks for specific service names or file paths indicative of PsExec activity, including the default 'PSEXESVC' service name, or file paths containing 'ADMIN$' or 'IPC$' shares, or a randomly named executable in the SystemRoot directory. It filters out activity from designated administrative workstations and common system accounts.
Detects the modification or termination of critical Windows security services using the Service Control utility (sc.exe). Attackers frequently disable Defender and associated security center services to allow undetected payload execution.
This rule detects the creation or modification of specific Launch Agent or Launch Daemon plist files on macOS, particularly those masquerading as 'com.apple.accountsd'. It also identifies the creation of a hidden directory '.com.apple.accountsd' within '/Library/Application Support'. This activity is highly suspicious as it indicates an attempt to establish persistence or execute malicious code by mimicking legitimate system services.
This rule detects the installation of known vulnerable kernel drivers (Bring Your Own Vulnerable Driver - BYOVD). These drivers are often exploited by adversaries to gain kernel-level code execution, elevate privileges, or disable security tools (EDR).
Detects VBScript (wscript.exe or cscript.exe) attempting to create Windows services using 'sc.exe create' or adding new users using 'net user /add'. This behavior is often associated with persistence mechanisms or privilege escalation by malicious scripts.
Detects the sc.exe utility creating a kernel-mode driver service pointing to a newly dropped .sys file in a temporary user directory. This activity is indicative of Bring Your Own Vulnerable Driver (BYOVD) techniques, often used by attackers to gain kernel-mode privileges and bypass security solutions.
Detects the SNOWLIGHT dropper (UNC5221) masquerading as the Windows Update service (wusvc.exe). It monitors for the creation of a Windows service named 'wusvc' or 'Windows Update Service' located outside of standard system directories, and the execution of 'wusvc.exe' from user-writable directories like AppData, Temp, or Downloads, indicating potential malicious persistence or dropper activity.
Detects activity associated with the SNOWLIGHT malware, specifically the dropping of a malicious executable named 'wusvc.exe' or 'WindowsUpdate' into user-writable directories (Downloads or AppData), followed by the creation of an automatically starting Windows service that executes the dropped file. This rule correlates process creation/service registration events with SCM event 7045 entries.
Detects use of Impacket tooling (wmiexec, psexec, smbexec, atexec, secretsdump) for lateral movement and remote service execution.
Detects use of Impacket tooling (wmiexec, psexec, smbexec, atexec, secretsdump) for lateral movement and remote service execution, as observed in Operation Escaneo attributed to MexicanMafia targeting LatAm critical infrastructure. The rule identifies Impacket activity through process command lines, service installations, and network connections to SMB (port 445) and DCOM (port 135) from Python or Impacket-related executables.
Detects the modification or termination of critical Windows security services using the Service Control utility (sc.exe). Attackers frequently disable Defender and associated security center services to allow undetected payload execution.
Page 20 of 37